Windows XP: is it possible to log startup and shutdown times in the system event log?

Question

I am trying to implement the Thistlethwaite's algorithm in Haskell, following the descriptions found here, but encountered difficulties.

So far, I have managed to represent the cube, make it move as one likes, and display it on the terminal (a 2-dimensional representation), but I got problems when trying to reduce a general cube to one which can be obtained from a standard cube by moves in the group (R, L, F, B, U2, D2) (notations as in the link), as there are too many cases to consider: how many colors on the up layer are wrongly-oriented, on the middle layer, etc. This is only the first stage in the description, but I found a mess in my codes already, so I must have missed something.

As I am not sure if my description above is clear, I put up the relevant codes below, which are not correct, but indicate the problem.

--To intersect lists, of which the sizes are not very large, I chose to import the Data.List
import Data.List

--Some type declarations
data Colors = R | B | W | Y | G | O
type R3 = (Int, Int, Int)
type Cube = R3 -> Colors
points :: [R3] --list of coordinates of facelets of a cube; there are 48 of them.
mU :: Cube -> Cube --and other 5 moves.
type Actions = [Cube -> Cube]
turn :: Cube -> Actions -> Cube --chains the actions and turns the cube.
edges :: [R3] --The edges of cubes

criterion :: Colors -> R3 -> Bool -- determine if the edges are mis-placed.
criterion co p@(x, y, z) = case co of --W and Y are up and down faces respectively.
 R -> not (or [abs(x) == 3, abs(y) == 3])
 B -> not (or [abs(y) == 3, abs(z) == 3])
 O -> not (or [abs(x) == 3, abs(y) == 3])
 G -> not (or [abs(y) == 3, abs(z) == 3])
 _ -> True


stage1 :: Cube -> Cube 
stage1 c = turn c opes where
    wrongs = do
            res <- [[]]
            eg <- edges
            if criterion (c eg) eg
              then res
              else res ++ [eg]
    ups = filter (\(x, y, z) -> y == 3) points
    downs = filter (\(x, y, z) -> y == -3) points
    middles = filter (\(x, y, z) -> y == 0) points
    opes = do
         res <- [[]]
         case length (intersect middles wrongs) of
         0 -> case [length (intersect ups wrongs) == 0, length (intersect downs wrongs) == 0] of
            [True, True] -> res
            [True, False] -> [mD] --A quarter turn of the downside of the cube.
            [False, True] -> [mU]
            _ -> [mD, mU]
         1 -> let [(x, y, z)] = intersect middles wrongs in
                if x == 3 then case [length (intersect ups wrongs) == 0, length (intersect downs wrongs) == 0] of
                    [True, True] -> if z > 0 then [mR, mU] else [mR, mD]
                    [True, False] -> if z > 0 then [mD, mR, mU] else [mD, mR, mD]
                    [False, True] -> if z > 0 then [mU, mR, mU] else [mU, mR, mD]
                    _ -> if z > 0 then [mD, mU, mR, mU] else [mD, mU, mR, mD]
                else []

Then I realized that the above code is wrong as I cannot simply make a quarter turn U or D which makes the correct edges, if any, become incorrect, and I shall discuss 125 = 5 * 5 * 5 cases according to how many wrong edges are on each of the three layers of the cube, which I think of as not "right."

So my question is how to implement an algorithm that can handle so many cases, in a nice way?

If something about the description is unclear, please tell me so that I can explain what I am doing and what my problem is.

Any ideas and suggestions are greatly appreciated, thanks very much in advance.

P.S. I originally wanted to implement Korf's or Kociemba's algorithms, though it turned out that I cannot even handle the simplest case.

Solution 1

Open gpedit.msc, go to Security Settings - Auditing, enable auditing for system events (startup and shutdown). They will appear in the Security log.

Solution 2

This information is already logged in the System Event Log.

Shutdown: Source = eventlog && Event ID = 6006
Startup: Source = eventlog && Event ID = 6009

If you need an approximate shutdown time in the event of an unexpected shutdown (e.g. BSOD or power loss), you'll need to use uptime.exe to enable the system heartbeat. It's available from MS KB 232243.

In Vista/7, system heartbeat is enabled by default. There are also more specific events that can be tracked.

Shutdown: Source = Kernel-General && Event ID = 13
Startup:  Source = Kernel-General && Event ID = 12

Comments

[MathematicalOrchid]

It's a little hard to follow what's going on without the corresponding type declarations.

[awllower]

@MathematicalOrchid Is there anything I forgot to add, or anything that is unclear? Also thanks for the attention.

[ErikR]

In general you should avoid using == with floating point arithmetic. Multiply all coordinates by 2 and use integer operations.

[awllower]

@user5402 I have changed that, thanks for pointing it out.

[Alessandro Jacopson]

+1 Thank you. I found the settings in gpedit.msc "Local Computer Policy","Computer Configuration","Windows Settings","Security Settings","Local Policies","Audit Policy","Audit system events". How can I configure the policy programmatically?

[Alessandro Jacopson]

Thank you, but it seems to me they are the start/stop of the event log facility, do they directly map to startup/shutdown of the machine?

[user1686]

@uvts_cvs: Try the auditusr command. I'm not sure if there is any programmatic way to access the audit settings; best is to deploy the group policy over Active Directory.

[afrazier]

Within a few seconds, yes. Event Log is one of the first things started and last to close. Ithas to be so that anything else can be reliably logged.

[awllower]

Thanks for the tip. And do you think an IDA* algorithm would do the work?